@wenathlan/devthink 2.0.12 → 2.0.14

package/tests/publishingpipeline.test.ts

@@ -0,0 +1,314 @@
+import { execFile } from "node:child_process";
+import { createHash } from "node:crypto";
+import { existsSync } from "node:fs";
+import { readdir, readFile, stat } from "node:fs/promises";
+import { join } from "node:path";
+import { describe, expect, it } from "vitest";
+import { promisify } from "node:util";
+import { parseDocument } from "yaml";
+import { artifactchannelof, artifactmanifestcheck, artifactmanifestnameof } from "../pack.js";
+
+const execute = promisify(execFile);
+
+/** The byte budget of the npm tarball: an engineering bound on the packed unpacked size so the tarball never grows unbounded — the file allowlist keeps the shipped paths honest inside it. */
+const tarballbudget = 80_000_000;
+
+describe("the publishing pipeline", () => {
+  it("keeps zero version drift across every packaging file", async () => {
+    const packagejson = JSON.parse(await readFile("package.json", "utf8"));
+    const version = String(packagejson.version);
+    /* the extension manifest, the version module and the web and mobile package mirrors */
+    const manifest = JSON.parse(await readFile("web/manifest.json", "utf8"));
+    expect(manifest.version).toBe(version);
+    const versionmodule = await readFile("version.ts", "utf8");
+    expect(versionmodule).toContain(`export const packageversion = "${version}" as const;`);
+    const webpackage = JSON.parse(await readFile("web/package.json", "utf8"));
+    expect(webpackage.version).toBe(version);
+    /* the mobile identity rides web/capacitor.config.ts — the single config design leaves no second version source to drift */
+    /* the browser overlays and the vsix overlay live inside the root manifest — the single manifest design of 1.1.93 leaves no second version source to drift */
+    expect(manifest.browsers?.firefox?.browser).toBe("firefox");
+    expect(manifest.browsers?.safari?.browser).toBe("safari");
+    expect(manifest.vsix?.name).toBe("devthink");
+    expect(Object.keys(manifest.browsers?.firefox ?? {})).not.toContain("version");
+    expect(Object.keys(manifest.browsers?.safari ?? {})).not.toContain("version");
+    expect(Object.keys(manifest.vsix ?? {})).not.toContain("version");
+    /* the registry envelopes of the merged repository: the maven pom carries the release in its revision property, the nuget csproj and the ruby gemspec beside it */
+    const pom = await readFile("pom.xml", "utf8");
+    expect(pom).toContain(`<revision>${version}</revision>`);
+    expect(pom).toContain("<packaging>jar</packaging>");
+    const csproj = await readFile("devthink.csproj", "utf8");
+    expect(/<Version>[^<]+<\/Version>/.exec(csproj)?.[0]).toBe(`<Version>${version}</Version>`);
+    const gemspec = await readFile("devthink.gemspec", "utf8");
+    expect(gemspec).toContain(`"${version}"`);
+    /* the java and csharp envelope carriers: the version constants answer the lockstep family the release sync propagates — the file names carry the lowercase technical name, the class names keep the presentation name, and the drift gate watches both stamps every bump (the 2.0.3 release stamped them by hand because no gate watched them) */
+    const javacarrier = await readFile("devthink.java", "utf8");
+    expect(javacarrier).toContain(`VERSION = "${version}"`);
+    const csharpcarrier = await readFile("devthinkcli.cs", "utf8");
+    expect(csharpcarrier).toContain(`Version = "${version}"`);
+    /* the version stamps of the container build defaults the build args ride */
+    const dockerfile = await readFile("Dockerfile", "utf8");
+    expect(dockerfile).toContain(`ARG DEVTHINK_VERSION=${version}`);
+    /* the changelog section the release notes render from */
+    const changelog = await readFile("CHANGELOG.md", "utf8");
+    const heading = new RegExp(`^##\\s+${version.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?:\\s|$)`, "m");
+    expect(heading.test(changelog)).toBe(true);
+    /* the generated release-document family — the readme version line, the release gates table, the runtime version catalog, the release notes document and the popup eyebrow label — stamps through the release metadata synchronization (node tests/release.mjs sync, the restamp the release pass runs), so those carries join the drift family at the restamp instead of a second version source living in the test */
+  });
+
+  it("emits and validates the release workflow controls through the checked test scripts", async () => {
+    /* the workflowcheck asserts the channel jobs, the gates and the new release steps; the npmgate asserts the new bundles stay allowed in the tarball */
+    const workflowcheck = await execute("node", ["tests/workflowcheck.mjs"]);
+    expect(workflowcheck.stdout).toContain("verified");
+    const npmgate = await execute("node", ["tests/npmgate.mjs"]);
+    expect(npmgate.stdout).toContain('"valid": true');
+  });
+
+  it("coordinates the release lane with the standalone publish workflows of the merged repository", async () => {
+    /* the publish-lane coordination of the merged layout: the release workflow owns the assembly, the verification and the draft → verify → publish chain plus the npmjs publication job the npm gate demands (the flat distribution tarball with provenance and the bounded retry), while the standalone publish workflows keep the registry lanes on their release-published triggers — no channel ships through two racing lanes, and the two npm lanes answer idempotently (the first publish wins, the latecomer skips) */
+    const release = await readFile(".github/workflows/release.yml", "utf8");
+    const workflow = parseDocument(release, { version: "1.2" }).toJS() as { jobs?: Record<string, unknown> };
+    expect(Object.keys(workflow.jobs ?? {})).toEqual([
+      "auto-tag",
+      "metadata",
+      "verify",
+      "assemble",
+      "vsix",
+      "firefox",
+      "site",
+      "sbom",
+      "attest",
+      "releaseassets",
+      "npmjs",
+      "githubrelease",
+    ]);
+    /* the draft → assemble → verify → publish chain the readiness gate walks */
+    for (const control of ["--draft", "sha256sum --check SHA256SUMS.txt", "draft=false"])
+      expect(release).toContain(control);
+    /* the registry lanes the standalone publish workflows own stay release-triggered with their registry controls */
+    const lanes: Array<[string, string]> = [
+      [".github/workflows/publishgithubnpm.yml", "npm.pkg.github.com"],
+      [".github/workflows/publishmaven.yml", "mvn --batch-mode"],
+      [".github/workflows/publishnuget.yml", "dotnet nuget push"],
+      [".github/workflows/publishrubygems.yml", "gem push devthink-*.gem"],
+      [".github/workflows/publishghcr.yml", "ghcr.io"],
+      [".github/workflows/publishnpmjs.yml", "registry.npmjs.org"],
+    ];
+    for (const [lane, control] of lanes) {
+      const standalone = await readFile(lane, "utf8");
+      expect(standalone).toContain("types: [published]");
+      expect(standalone).toContain(control);
+    }
+    /* the npm channel stays idempotent across its two lanes: both answer the same existence check before any publish */
+    expect(release).toContain("npmjs version already exists; skipping publish.");
+    const npmjs = await readFile(".github/workflows/publishnpmjs.yml", "utf8");
+    expect(npmjs).toContain("already exists; skipping publish.");
+  });
+
+  it("covers every built artifact with names, sizes, checksums and channels in the local artifact manifest", async () => {
+    if (!existsSync("dist/checksums.txt"))
+      return; /* the validate chain runs the tests before the build; the built-set pass runs on the next pass and in the ci lanes that build first */
+    const packagejson = JSON.parse(await readFile("package.json", "utf8"));
+    const version = String(packagejson.version);
+    const manifest = JSON.parse(await readFile("dist/artifactmanifest.json", "utf8")) as {
+      name: string;
+      version: string;
+      banner: string;
+      artifacts: Array<{ name: string; size: number; checksum: string; channels: string[] }>;
+    };
+    expect(manifest.version).toBe(version);
+    expect(manifest.name).toBe("devthink artifact manifest");
+    expect(manifest.artifacts.length).toBeGreaterThan(10);
+    for (const entry of manifest.artifacts) {
+      /* the naming convention keeps every artifact name lowercase without underscores */
+      expect(entry.name).toMatch(/^[a-z0-9./-]+$/);
+      expect(entry.name).not.toContain("_");
+      expect(entry.channels.length).toBeGreaterThan(0);
+      expect(entry.channels).toEqual(artifactchannelof(entry.name, version));
+      /* the recorded size and sha256 checksum match the file on disk */
+      const bytes = await readFile(entry.name);
+      expect(entry.size).toBe(bytes.length);
+      expect(entry.checksum).toBe(createHash("sha256").update(bytes).digest("hex"));
+    }
+    /* the manifest covers the artifacts of every channel of the release */
+    const names = manifest.artifacts.map((entry) => entry.name);
+    expect(names).toContain(`dist/devthink${version}.zip`);
+    expect(names).toContain(`dist/devthink-firefox-${version}.xpi`);
+    expect(names).toContain(`dist/devthink-safari-${version}.zip`);
+    expect(names).toContain(`dist/devthink-vscode-${version}.vsix`);
+    expect(names).toContain(`dist/devthink-site-${version}.zip`);
+    expect(names).toContain(`dist/devthink-declarations-${version}.zip`);
+    /* the manifest never lists itself: a self entry would need its own checksum of itself, so the checksums file covers dist/artifactmanifest.json instead */
+  });
+
+  it("covers every dist artifact the checksums file records with its true sha256 digest", async () => {
+    if (!existsSync("dist/checksums.txt"))
+      return; /* the validate chain runs the tests before the build; the checksum pass runs on the next pass and in the ci lanes that build first */
+    const lines = (await readFile("dist/checksums.txt", "utf8")).split("\n").filter((line) => line.trim() !== "");
+    expect(lines.length).toBeGreaterThan(10);
+    for (const line of lines) {
+      const [digest, name] = line.split(/\s+/);
+      expect(digest).toMatch(/^[0-9a-f]{64}$/);
+      if (name === "manifest.json")
+        continue; /* the identity record of the published key: the build pins the manifest identity digest beside the bundle checksums so the pin rides the generated artifact, never a hard coded source constant */
+      if ((name ?? "").startsWith("site/"))
+        continue; /* the static site assets carry their own manifest and hashed names, not the reviewed naming rule */
+      expect(name ?? "").not.toContain("_");
+      const bytes = await readFile(`dist/${name}`);
+      expect(createHash("sha256").update(bytes).digest("hex")).toBe(digest);
+    }
+    /* the publishing pipeline bundles and the manifest itself join the covered set */
+    const names = lines.map((line) => line.split(/\s+/)[1] ?? "");
+    for (const bundle of ["bridge.js", "crossbrowser.js", "pack.js", "http.js", "artifactmanifest.json"])
+      expect(names).toContain(bundle);
+  });
+
+  it("answers the artifact manifest name of the release set", async () => {
+    const packagejson = JSON.parse(await readFile("package.json", "utf8"));
+    const version = String(packagejson.version);
+    expect(artifactmanifestnameof(version)).toBe(`devthink-artifactmanifest-${version}.json`);
+    if (!existsSync("dist/artifactmanifest.json"))
+      return; /* the validate chain runs the tests before the build; the manifest check pass runs on the next pass and in the ci lanes that build first */
+    /* the manifest check catches a drifted built set before the release ships */
+    const manifest = JSON.parse(await readFile("dist/artifactmanifest.json", "utf8")) as {
+      name: string;
+      version: string;
+      banner: string;
+      artifacts: Array<{ name: string; size: number; checksum: string; channels: string[] }>;
+    };
+    const files = manifest.artifacts.map((entry) => ({ name: entry.name, checksum: entry.checksum }));
+    expect(artifactmanifestcheck({ manifest, files }).ok).toBe(true);
+    const drifted = artifactmanifestcheck({ manifest, files: files.slice(0, Math.max(1, files.length - 1)) });
+    expect(drifted.ok).toBe(false);
+  });
+
+  it("keeps the npm tarball inside its size budget through the flat staged package", { timeout: 120_000 }, async () => {
+    if (!existsSync("dist/checksums.txt"))
+      return; /* the validate chain runs the tests before the build; the tarball pass runs on the next pass and in the ci lanes that build first */
+    const packagejson = JSON.parse(await readFile("package.json", "utf8"));
+    const stagedmanifest = JSON.parse(await readFile("distpackage/package.json", "utf8"));
+    const packed = await execute("npm", ["pack", "./distpackage", "--dry-run", "--json"]);
+    /* npm eleven answers a json array of tarball entries while npm twelve answers an object keyed by package name: the dry run reads the single entry of this package under either shape so the pinned toolchain majors both verify the tarball */
+    const parsed = JSON.parse(packed.stdout) as unknown;
+    const entry = (
+      Array.isArray(parsed)
+        ? parsed[0]
+        : (parsed as Record<string, { files: Array<{ path: string; size: number }>; size: number }>)[
+            String(stagedmanifest.name)
+          ]
+    ) as { files: Array<{ path: string; size: number }>; size: number } | undefined;
+    if (entry === undefined) throw new Error("The npm pack dry run reported no tarball entry.");
+    /* the unpacked size of the tarball stays inside the engineering budget */
+    expect(entry.size).toBeLessThan(tarballbudget);
+    /* the staged manifest carries no files allowlist: the staging directory IS the package set, so every shipped file must exist in the staged tree and every staged file must ship */
+    const stagedwalk = async (relative: string): Promise<string[]> => {
+      const found: string[] = [];
+      for (const item of await readdir(join("distpackage", relative), { withFileTypes: true })) {
+        const child = relative === "" ? item.name : `${relative}/${item.name}`;
+        if (item.isDirectory()) found.push(...(await stagedwalk(child)));
+        else found.push(child);
+      }
+      return found;
+    };
+    const stagedset = new Set(await stagedwalk(""));
+    const shippedpaths = entry.files.map((file) => file.path.replace(/^distpackage\//, ""));
+    for (const path of shippedpaths) expect(stagedset.has(path)).toBe(true);
+    for (const staged of stagedset) expect(shippedpaths).toContain(staged);
+    /* the flat organization: no shipped path nests past two directories */
+    for (const path of shippedpaths) expect(path.split("/").length).toBeLessThanOrEqual(3);
+    /* the surface, the data groups and the identity files ship at the package root */
+    for (const artifact of [
+      "index.js",
+      "index.cjs",
+      "index.neutral.js",
+      "devthink.umd.js",
+      "policy.js",
+      "protocol.js",
+      "memory.js",
+      "progress.js",
+      "hardening.js",
+      "dashdone.js",
+      "node.cjs",
+      "bun.js",
+      "deno.js",
+      "cli.js",
+      "headless.js",
+      "mcp.js",
+      "bridge.js",
+      "companion.js",
+      "nativehost.template.json",
+      "pack.js",
+      "http.js",
+      "server.js",
+      "crossbrowser.js",
+      "index.d.ts",
+      "umd.d.ts",
+      "cli.d.ts",
+      "checksums.txt",
+      "gallery.json",
+      "umd-example.html",
+      "manifest.json",
+      "README.md",
+      "LICENSE",
+      "CHANGELOG.md",
+      "package.json",
+      "caps/background.json",
+      "caps/library.json",
+      "schemas/plan.schema.json",
+      "fixtures/example-org-pagestate.json",
+      "fixtures/plans/release-notes-plan.json",
+      "fixtures/recipes/scrapeproductgrid.json",
+      "fixtures/pages/feed.html",
+      "fixtures/importers/v1-plan.json",
+    ])
+      expect(shippedpaths).toContain(artifact);
+    /* the minified variants and the release archives stay out of the package: the release assets own them */
+    for (const path of shippedpaths) expect(path.endsWith(".min.js") || path.endsWith(".min.cjs")).toBe(false);
+    /* the staged manifest mirrors the repository manifest with the entry paths remapped to the package root */
+    expect(stagedmanifest.name).toBe(packagejson.name);
+    expect(stagedmanifest.version).toBe(packagejson.version);
+    expect(stagedmanifest.main).toBe("./index.js");
+    expect(stagedmanifest.types).toBe("./index.d.ts");
+    expect(stagedmanifest.bin.devthink).toBe("./cli.js");
+    const exporttargets: string[] = [];
+    const collecttargets = (node: unknown) => {
+      if (typeof node === "string") exporttargets.push(node);
+      else if (Array.isArray(node)) node.forEach(collecttargets);
+      else if (node !== null && typeof node === "object") Object.values(node).forEach(collecttargets);
+    };
+    collecttargets(stagedmanifest.exports);
+    expect(exporttargets.length).toBeGreaterThan(20);
+    for (const target of exporttargets) {
+      expect(target.startsWith("./")).toBe(true);
+      expect(target.startsWith("./dist/")).toBe(false);
+      expect(existsSync(join("distpackage", target.replace(/^\.\//, "")))).toBe(true);
+    }
+  });
+
+  it("stamps the built vsix artifact with the manifest version and the consent fields", async () => {
+    if (!existsSync(`dist/devthink-vscode-${String(JSON.parse(await readFile("package.json", "utf8")).version)}.vsix`))
+      return; /* the validate chain runs the tests before the build; the vsix pass runs on the next pass and in the ci lanes that build first */
+    const packagejson = JSON.parse(await readFile("package.json", "utf8"));
+    const version = String(packagejson.version);
+    const bytes = await readFile(`dist/devthink-vscode-${version}.vsix`);
+    /* the vsix is a stored zip: the local file header magic and the end of central directory record both read back */
+    expect(bytes.readUInt32LE(0)).toBe(0x04034b50);
+    const end = bytes.subarray(bytes.length - 22);
+    expect(end.readUInt32LE(0)).toBe(0x06054b50);
+    expect(end.readUInt16LE(8)).toBe(6);
+    const text = bytes.toString("utf8");
+    expect(text).toContain(`"version": "${version}"`);
+    expect(text).toContain('"telemetry": "off"');
+    expect(text).not.toMatch(/marketplace\.visualstudio\.com|clients2\.google\.com/i);
+  });
+
+  it("keeps the site and declaration artifacts beside the browser builds", async () => {
+    if (!existsSync("dist/checksums.txt"))
+      return; /* the validate chain runs the tests before the build; the artifact pass runs on the next pass and in the ci lanes that build first */
+    const packagejson = JSON.parse(await readFile("package.json", "utf8"));
+    const version = String(packagejson.version);
+    const site = await stat(`dist/devthink-site-${version}.zip`);
+    expect(site.size).toBeGreaterThan(100);
+    const declarations = await stat(`dist/devthink-declarations-${version}.zip`);
+    expect(declarations.size).toBeGreaterThan(100);
+  });
+});

package/tests/quickactions.test.ts

@@ -0,0 +1,164 @@
+import { describe, expect, it } from "vitest";
+import {
+  omniboxtasktotaskinput,
+  parseomniboxtask,
+  parseshortcut,
+  quickactioncatalog,
+  quickactionsfor,
+  shortcutbindingafter,
+  shortcutcommandof,
+  shortcutdefaults,
+  shortcutdispatchable,
+  shortcuttext,
+} from "../views.js";
+import { surfacepalette } from "../views.js";
+import { omniboxtaskgate, quickactiongate, shortcutkeygate } from "../policy.js";
+
+const now = 1_800_000_000_000;
+
+describe("quickactions, shortcutkeys and omniboxtask", () => {
+  it("gates the quickactions behind the origin allowlist of the clicked tab", () => {
+    const catalog = quickactioncatalog();
+    expect(catalog.map((action) => action.id)).toEqual([
+      "extractpage",
+      "captureshot",
+      "runrecent",
+      "opendashboardpage",
+    ]);
+    const granted = ["https://example.com"];
+    const permitted = quickactionsfor(catalog, {
+      origin: "https://example.com",
+      granted,
+      sessionactive: true,
+      grantedcapabilities: ["activeTab", "storage", "scripting", "sidePanel", "downloads"],
+    });
+    expect(permitted.map((action) => action.id)).toEqual([
+      "extractpage",
+      "captureshot",
+      "runrecent",
+      "opendashboardpage",
+    ]);
+    const nosession = quickactionsfor(catalog, {
+      origin: "https://example.com",
+      granted,
+      sessionactive: false,
+      grantedcapabilities: ["activeTab", "storage", "scripting", "sidePanel", "downloads"],
+    });
+    expect(nosession.map((action) => action.id)).toEqual(["opendashboardpage"]);
+    const ungranted = quickactionsfor(catalog, {
+      origin: "https://other.example",
+      granted,
+      sessionactive: true,
+      grantedcapabilities: ["activeTab", "storage", "scripting", "sidePanel", "downloads"],
+    });
+    expect(ungranted).toHaveLength(0);
+    expect(
+      quickactiongate({
+        action: { command: "starttask", origin: "https://example.com", session: true },
+        granted,
+        sessionactive: false,
+        capabilities: ["activeTab"],
+      }).reason,
+    ).toMatch(/active browser session/);
+    expect(
+      quickactiongate({
+        action: { command: "captureshot", origin: "https://example.com", permission: "downloads" },
+        granted,
+        sessionactive: true,
+        capabilities: ["activeTab"],
+      }).allowed,
+    ).toBe(false);
+  });
+
+  it("binds run, pause, resume, cancelrun and the palette to user editable shortcuts", () => {
+    const defaults = shortcutdefaults();
+    expect(defaults.map((binding) => binding.command)).toEqual([
+      "starttask",
+      "pauserun",
+      "resumerun",
+      "cancelrun",
+      "commandpalette",
+    ]);
+    expect(defaults.every((binding) => binding.editable)).toBe(true);
+    expect(
+      shortcuttext(
+        defaults.find((binding) => binding.command === "commandpalette") ?? {
+          command: "",
+          key: "",
+          modifiers: [],
+          editable: true,
+          surface: "popup",
+        },
+      ),
+    ).toBe("ctrl+.");
+    expect(parseshortcut("Ctrl+Shift+P")).toEqual({ key: "p", modifiers: ["ctrl", "shift"] });
+    expect(() => parseshortcut("ctrl+")).toThrow(/key/);
+    const edited = shortcutbindingafter(defaults, "pauserun", "alt+q");
+    expect(edited.find((binding) => binding.command === "pauserun")?.key).toBe("q");
+    expect(() => shortcutbindingafter(defaults, "unknowncommand", "alt+q")).toThrow(/know no/);
+  });
+
+  it("matches a pressed key against the bindings with the palette command open from every surface", () => {
+    const bindings = shortcutdefaults();
+    expect(shortcutcommandof(bindings, { key: ".", modifiers: ["ctrl"], surface: "sidepanel" })).toBe("commandpalette");
+    expect(shortcutcommandof(bindings, { key: ".", modifiers: ["ctrl"], surface: "dashboardpage" })).toBe(
+      "commandpalette",
+    );
+    expect(shortcutcommandof(bindings, { key: "p", modifiers: ["ctrl", "shift"], surface: "sidepanel" })).toBe(
+      "pauserun",
+    );
+    expect(shortcutcommandof(bindings, { key: "p", modifiers: ["ctrl", "shift"], surface: "popup" })).toBeUndefined();
+    expect(shortcutcommandof(bindings, { key: "z", modifiers: [], surface: "popup" })).toBeUndefined();
+  });
+
+  it("keeps the palette gates intact behind every shortcut dispatch", () => {
+    const entries = surfacepalette();
+    expect(shortcutdispatchable("starttask", entries, { granted: ["activeTab", "storage"], sessionactive: true })).toBe(
+      true,
+    );
+    expect(
+      shortcutdispatchable("cancelrun", entries, { granted: ["activeTab", "storage"], sessionactive: false }),
+    ).toBe(false);
+    expect(shortcutdispatchable("cancelrun", entries, { granted: ["activeTab", "storage"], sessionactive: true })).toBe(
+      true,
+    );
+    expect(shortcutdispatchable("commandpalette", entries, { granted: [], sessionactive: false })).toBe(true);
+    expect(
+      shortcutkeygate({
+        command: "historysearch",
+        palettecommands: entries.map((entry) => entry.action.command),
+        granted: ["tabs"],
+        sessionactive: true,
+        action: { permission: "tabs" },
+      }).allowed,
+    ).toBe(true);
+    expect(
+      shortcutkeygate({
+        command: "unknowncommand",
+        palettecommands: entries.map((entry) => entry.action.command),
+        granted: [],
+        sessionactive: false,
+      }).reason,
+    ).toMatch(/commandpalette command/);
+  });
+
+  it("parses the omnibox keyword into a taskinput submission of the proposal flow", () => {
+    const submission = parseomniboxtask({
+      text: "  Collect the pricing table  ",
+      origin: "https://example.com",
+      at: now,
+    });
+    expect(submission.text).toBe("Collect the pricing table");
+    expect(submission.surface).toBe("omnibox");
+    expect(() => parseomniboxtask({ text: "  ", origin: "https://example.com", at: now })).toThrow(/goal/);
+    expect(() => parseomniboxtask({ text: "goal", origin: " ", at: now })).toThrow(/origin/);
+    const taskinput = omniboxtasktotaskinput(submission);
+    expect(taskinput.origin).toBe("https://example.com");
+    expect(taskinput.surface).toBe("omnibox");
+    expect(omniboxtaskgate({ text: "goal", origin: "https://example.com", direct: false }).allowed).toBe(true);
+    expect(omniboxtaskgate({ text: "goal", origin: "https://example.com", direct: true }).reason).toMatch(
+      /never executes a goal directly/,
+    );
+    expect(omniboxtaskgate({ text: "", origin: "https://example.com", direct: false }).allowed).toBe(false);
+  });
+});

package/tests/readiness.test.ts

@@ -0,0 +1,78 @@
+import { existsSync } from "node:fs";
+import { readFile } from "node:fs/promises";
+import { describe, expect, it } from "vitest";
+import { runreadinesssuite } from "./readiness.mjs";
+
+describe("the release readiness review of the platform release", () => {
+  it("answers a verdict row with its evidence link for every gate the review walks", async () => {
+    const report = await runreadinesssuite();
+    expect(report.verdicts.length).toBeGreaterThanOrEqual(20);
+    for (const verdict of report.verdicts) {
+      expect(verdict.gate.length).toBeGreaterThan(10);
+      expect(typeof verdict.ok).toBe("boolean");
+      expect(verdict.evidence.length).toBeGreaterThan(10);
+    }
+  });
+
+  it("walks every candidate gate the chain greened and answers the go decision the release stamps", async () => {
+    const report = await runreadinesssuite();
+    const names = report.verdicts.map((verdict) => verdict.gate);
+    for (const expected of [
+      "pool audit",
+      "api freeze",
+      "deprecation window",
+      "migrateplan",
+      "pentest",
+      "csp",
+      "permission diff",
+      "transparency",
+      "agent certification",
+      "cost certification",
+      "doc check",
+      "recipes",
+      "sweep",
+      "matrix",
+      "telemetry",
+      "changelog",
+      "migration guide",
+      "release notes",
+      "roadmap",
+      "release pipeline",
+      "capability manifests",
+    ]) {
+      expect(names.join("; ")).toContain(expected);
+    }
+    /* the go assertion runs where the lane recorded the candidate evidence: the validate chain runs the candidate gates before the suite, and the verify workflow runs the standalone readiness step after every gate wrote its artifact; a lane without the recorded artifacts (the bun matrix lane) still verifies the structure and the gate names above */
+    if (
+      existsSync("tests/artifacts/poolcoverage.json") &&
+      existsSync("tests/artifacts/sweep.json") &&
+      existsSync("tests/artifacts/telemetryfree.json") &&
+      existsSync("tests/artifacts/agentcert.json") &&
+      existsSync("tests/artifacts/doccheck.json") &&
+      existsSync("tests/artifacts/recipes.json")
+    ) {
+      expect(report.godecision).toBe("go");
+      expect(report.summary.blocked).toBe(0);
+      expect(report.summary.ok).toBe(report.summary.gates);
+    }
+  });
+
+  it("records the artifact and the go decision review the roadmap publishes", async () => {
+    if (!existsSync("tests/artifacts/readiness.json"))
+      return; /* the readiness lane runs after the candidate gates recorded their artifacts; the artifact pass covers the recorded state */
+    const artifact = JSON.parse(await readFile("tests/artifacts/readiness.json", "utf8")) as {
+      verdicts: Array<{ gate: string; ok: boolean }>;
+      summary: { gates: number; ok: number; blocked: number };
+      godecision: string;
+    };
+    if (artifact.summary.blocked === 0) {
+      expect(artifact.summary.gates).toBe(artifact.summary.ok);
+      expect(artifact.godecision).toBe("go");
+      for (const verdict of artifact.verdicts) expect(verdict.ok).toBe(true);
+    }
+    const review = await readFile("docs/readiness.md", "utf8");
+    expect(review).toContain("# Release readiness review");
+    expect(review).toContain("The go decision");
+    expect(review).toContain("| Gate | Verdict | Evidence |");
+  });
+});